From fd927beac71a40be82db3b058cfd74160fa9d21b Mon Sep 17 00:00:00 2001
From: Sam <sam@samr1.net>
Date: Sat, 4 Mar 2023 19:50:21 +0100
Subject: [PATCH] API - update workout file name

 remove unneeded use of `mkstemp`
---
 .../workouts/test_workouts_api_1_post.py      | 63 ++++++++++---------
 fittrackee/workouts/utils/workouts.py         |  7 +--
 2 files changed, 36 insertions(+), 34 deletions(-)

diff --git a/fittrackee/tests/workouts/test_workouts_api_1_post.py b/fittrackee/tests/workouts/test_workouts_api_1_post.py
index b1071503..e149bec2 100644
--- a/fittrackee/tests/workouts/test_workouts_api_1_post.py
+++ b/fittrackee/tests/workouts/test_workouts_api_1_post.py
@@ -1,10 +1,9 @@
 import json
 import os
-import re
 from datetime import datetime
 from io import BytesIO
 from typing import Any, Dict, Optional
-from unittest.mock import Mock
+from unittest.mock import Mock, patch
 
 import pytest
 from flask import Flask
@@ -300,23 +299,25 @@ class TestPostWorkoutWithGpx(ApiTestCaseMixin, CallArgsMixin):
         client, auth_token = self.get_test_client_and_auth_token(
             app, user_1.email
         )
+        expected_suffix = self.random_string()
 
-        client.post(
-            '/api/workouts',
-            data=dict(
-                file=(BytesIO(str.encode(gpx_file)), 'example.gpx'),
-                data='{"sport_id": 1}',
-            ),
-            headers=dict(
-                content_type='multipart/form-data',
-                Authorization=f'Bearer {auth_token}',
-            ),
-        )
+        with patch('secrets.token_urlsafe', return_value=expected_suffix):
+            client.post(
+                '/api/workouts',
+                data=dict(
+                    file=(BytesIO(str.encode(gpx_file)), 'example.gpx'),
+                    data='{"sport_id": 1}',
+                ),
+                headers=dict(
+                    content_type='multipart/form-data',
+                    Authorization=f'Bearer {auth_token}',
+                ),
+            )
 
         workout = Workout.query.first()
-        assert re.match(
-            r'^workouts/1/2018-03-13_12-44-45_1_([\w\d_-]*).gpx$',
-            workout.gpx,
+        assert (
+            workout.gpx
+            == f"workouts/1/2018-03-13_12-44-45_1_{expected_suffix}.gpx"
         )
 
     def test_it_creates_workout_with_expecting_map_path(
@@ -325,23 +326,25 @@ class TestPostWorkoutWithGpx(ApiTestCaseMixin, CallArgsMixin):
         client, auth_token = self.get_test_client_and_auth_token(
             app, user_1.email
         )
+        expected_suffix = self.random_string()
 
-        client.post(
-            '/api/workouts',
-            data=dict(
-                file=(BytesIO(str.encode(gpx_file)), 'example.gpx'),
-                data='{"sport_id": 1}',
-            ),
-            headers=dict(
-                content_type='multipart/form-data',
-                Authorization=f'Bearer {auth_token}',
-            ),
-        )
+        with patch('secrets.token_urlsafe', return_value=expected_suffix):
+            client.post(
+                '/api/workouts',
+                data=dict(
+                    file=(BytesIO(str.encode(gpx_file)), 'example.gpx'),
+                    data='{"sport_id": 1}',
+                ),
+                headers=dict(
+                    content_type='multipart/form-data',
+                    Authorization=f'Bearer {auth_token}',
+                ),
+            )
 
         workout = Workout.query.first()
-        assert re.match(
-            r'^workouts/1/2018-03-13_12-44-45_1_([\w\d_-]*).png$',
-            workout.map,
+        assert (
+            workout.map
+            == f"workouts/1/2018-03-13_12-44-45_1_{expected_suffix}.png"
         )
 
     def test_it_adds_a_workout_with_gpx_without_name(
diff --git a/fittrackee/workouts/utils/workouts.py b/fittrackee/workouts/utils/workouts.py
index a60f9f81..f033177a 100644
--- a/fittrackee/workouts/utils/workouts.py
+++ b/fittrackee/workouts/utils/workouts.py
@@ -1,5 +1,5 @@
 import os
-import tempfile
+import secrets
 import zipfile
 from datetime import datetime, timedelta
 from typing import Dict, List, Optional, Tuple, Union
@@ -272,9 +272,8 @@ def get_new_file_path(
     """
     if not extension and old_filename:
         extension = f".{old_filename.rsplit('.', 1)[1].lower()}"
-    _, new_filename = tempfile.mkstemp(
-        prefix=f'{workout_date}_{sport_id}_', suffix=extension
-    )
+    suffix = secrets.token_urlsafe(8)
+    new_filename = f"{workout_date}_{sport_id}_{suffix}{extension}"
     dir_path = os.path.join('workouts', str(auth_user_id))
     file_path = os.path.join(dir_path, new_filename.split('/')[-1])
     return file_path